AZ-900 Describe Azure management and governance Practice Question
A company manages 50 Azure subscriptions that contain thousands of resources. The DevOps team needs to identify all virtual machines that are tagged with 'Environment: Production' across all subscriptions. They need a single query that returns the VM name, resource group, and location for every such VM. The team does not want to write PowerShell commands or loop through each subscription manually. Which Azure service should they use?
⚠ Common exam trap
It's easy for candidates to confuse Azure Policy (which enforces tagging rules) with Azure Resource Graph (which queries existing tags), or they assume that cross-subscription queries require PowerShell or CLI loops, but ARG natively supports tenant-wide queries without manual iteration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Resource Graph
Azure Resource Graph (ARG) is the correct service because it enables efficient, cross-subscription querying of Azure resources using the Kusto Query Language (KQL). With a single ARG query, the DevOps team can filter all virtual machines tagged with 'Environment: Production' across all 50 subscriptions and project only the VM name, resource group, and location, without needing to loop through subscriptions or write PowerShell scripts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Resource Graph
Why this is correct
Azure Resource Graph is the correct answer because it is a purpose-built service for efficiently querying resource metadata across multiple subscriptions. You write a Kusto Query Language (KQL) query to filter and project properties like VM name, resource group, and location, and Resource Graph uses its indexed store to return results from all 50 subscriptions in one call. Unlike the ARM API, it does not require custom pagination or looping, and it returns only the specific fields you request, making it ideal for ad-hoc discovery and inventory scenarios.
- ✗
Azure Advisor
Why it's wrong here
Azure Advisor is incorrect because it is a personalized recommendation engine, not a query service. It continuously evaluates your deployed resources against best practices for cost, security, reliability, and performance, and surfaces actionable recommendations—like underutilized VMs or unsecured admin accounts. However, Advisor does not accept ad-hoc queries, nor does it expose a searchable interface to list all virtual machines by name, location, or other arbitrary properties across your subscriptions.
When this WOULD be correct
A company wants to review cost optimization recommendations for all virtual machines across their subscriptions to reduce spending. Azure Advisor would be the correct service to use.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is incorrect because its function is to enforce governance rules and assess compliance, not to answer arbitrary resource queries. When you assign policy definitions, Azure Policy evaluates resources and shows which ones comply with the defined conditions, such as "all VMs must use managed disks." While you could use the compliance view to see a list of non-compliant VMs, it is not a general query engine for discovering resources by name, type, location, or other dynamic criteria across all 50 subscriptions.
When this WOULD be correct
A company needs to ensure that all virtual machines tagged 'Environment: Production' have a specific backup policy applied. Azure Policy can assign a built-in or custom policy to audit or enforce backup configurations across all subscriptions.
- ✗
Azure Resource Manager
Why it's wrong here
Azure Resource Manager (ARM) is the management layer that handles deployment and management of resources. While ARM APIs can list resources, doing so across many subscriptions requires custom scripting and multiple API calls, making it less efficient than Azure Resource Graph.
When this WOULD be correct
A question asks: 'Which Azure service is used to deploy, manage, and organize resources, and provides a consistent management layer for all Azure resources?' In that context, Azure Resource Manager is the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Resource GraphCorrect answer▾
Why this is correct
Azure Resource Graph is the correct answer because it is a purpose-built service for efficiently querying resource metadata across multiple subscriptions. You write a Kusto Query Language (KQL) query to filter and project properties like VM name, resource group, and location, and Resource Graph uses its indexed store to return results from all 50 subscriptions in one call. Unlike the ARM API, it does not require custom pagination or looping, and it returns only the specific fields you request, making it ideal for ad-hoc discovery and inventory scenarios.
✗Azure AdvisorWrong answer — click to see why▾
Why this is wrong here
Azure Advisor provides personalized recommendations for cost, security, reliability, and performance, but it cannot run custom queries across subscriptions to find tagged resources.
★ When this WOULD be the correct answer
A company wants to review cost optimization recommendations for all virtual machines across their subscriptions to reduce spending. Azure Advisor would be the correct service to use.
Why candidates choose this
Candidates may confuse Advisor's ability to analyze resources across subscriptions with the querying capability needed here, or think it can list resources based on tags.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy is used to enforce compliance rules and audit resource configurations, not to query and return resource properties across subscriptions. It cannot produce a list of VM names, resource groups, and locations from a single query.
★ When this WOULD be the correct answer
A company needs to ensure that all virtual machines tagged 'Environment: Production' have a specific backup policy applied. Azure Policy can assign a built-in or custom policy to audit or enforce backup configurations across all subscriptions.
Why candidates choose this
Candidates may confuse Azure Policy's ability to evaluate tags and resources with the ability to retrieve and list resource details, not realizing Policy is for governance, not ad-hoc querying.
✗Azure Resource ManagerWrong answer — click to see why▾
Why this is wrong here
Azure Resource Manager (ARM) is the deployment and management service for Azure, but it does not provide a cross-subscription query capability to search for resources by tags across multiple subscriptions in a single query.
★ When this WOULD be the correct answer
A question asks: 'Which Azure service is used to deploy, manage, and organize resources, and provides a consistent management layer for all Azure resources?' In that context, Azure Resource Manager is the correct answer.
Why candidates choose this
Candidates may confuse Azure Resource Manager with Azure Resource Graph because both have 'Resource' in their name and are involved in resource management, leading them to think ARM can perform queries across subscriptions.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
Key term
Query
A query is a request for information from a database, asking a specific question to retrieve, update, or manipulate data.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.